Hardware-based message block padding for hash algorithms

Abstract

A processor includes an execution unit to execute a message padding instruction that includes an operand field that indicates a register that buffers a message block segment of a message block to be padded and a pattern field that indicates which hash function is to be applied to the message block. The execution unit includes a fill circuit configured to receive a segment of a message block from a register indicated by the operand segment, where the message block spans a plurality of registers in the register file. Based on the hash function indicated by the pattern field, the padding circuitry selects a byte location in the message block segment, inserts at least one padding byte at the location, and inserts the at least one padding byte within the message block segment at the byte location. Message block segments as filled by at least one fill byte are written back to the register file.

Description

Background Art

[0001] The present invention relates generally to data processing, and in particular, to efficiently padding message blocks of a hash algorithm.

[0002] An important aspect of data security is the protection of data at rest (e.g., data stored in a data storage device) or in transit (e.g., during transmission) through encryption. In general, encryption involves converting unencrypted data (called plaintext) into encrypted data (called ciphertext) by using an encryption function in conjunction with the plaintext and one or more encryption keys. To recover the plaintext from the ciphertext, the ciphertext is processed by a decryption function using one or more decryption keys. Thus, encryption provides data security by requiring knowledge of an additional secret (i.e., a decryption key) before a party can access the protected plaintext.

[0003] In many implementations, data encryption is performed using software executed on a general-purpose processor. While implementing encryption in software offers the advantage of being able to select different encryption algorithms and easily adapt the selected encryption algorithm to use with various data lengths, performing encryption in software also has the disadvantage of relatively poor performance. In the era of "big data", the size of data sets continues to grow significantly, and the performance achieved by encryption implemented by software may not be acceptable when encrypting large messages and / or data sets. Concerns about encryption performance are also increasing due to the need to run enterprise applications that utilize encrypted data in order to mitigate the impact of "hacking" and other cyber attacks and to ensure compliance with regulatory requirements. Therefore, it is often desirable to provide support for encryption in hardware to achieve improved performance. Summary of the invention

[0004] The present disclosure understands that one class of cryptographic algorithms for which hardware support is desired is hash functions, including but not limited to hash functions belonging to the secure hash algorithm (SHA) family of standards. As is well known in the art, the SHA family of standards defines a hash algorithm approved by the National Institute of Standards and Technology (NIST) for generating a squeezed representation of a message (i.e., a message digest). The SHA family of standards is described in detail in two Federal Information Processing Standards (FIPS): FIPS180-4 "Secure Hash Standard" and FIPS202 "SHA-3 Standard: Permutation-Based Hash and Extensible Output Functions", both of which are incorporated herein by reference. FIPS180-4 specifies seven hash algorithms, namely SHA-1 (Secure Hash Algorithm 1) and SHA-2 hash algorithm families, including SHA-224, SHA-256, SHA-384, SHA-512 / 224, and SHA-512 / 256. FIPS 202 also specifies four SHA-3 hash algorithms with fixed-length outputs (i.e., SHA3-224, SHA3-256, SHA3-384, and SHA3-512) and two closely related "Extensible Output" Functions (XOFs) called SHAKE128 and SHAKE256 (where SHAKE is an abbreviation for Secure Hash Algorithm and Keccak, respectively). Additional uses for the SHA family of standards (e.g., as a stream cipher, authenticated encryption system, or tree hashing scheme) have not yet been adopted as NIST standards.

[0005] Given the wide variety of hash functions and the large differences in data sizes for hash functions (even within the SHA family of standards), extensive support for hash functions in hardware may result in a large area within the processor floor plan being occupied by circuitry that implements the hash functions. Therefore, some hardware solutions choose to implement such circuitry separately from the processor core, for example, in a bus-connected application-specific integrated circuit (ASIC) or accelerator. While potentially providing better performance than some software solutions, the use of these auxiliary circuits is still subject to bus and memory access delays and message passing overhead, which again limits performance as compared to that achievable within a high-performance processor core. This performance loss is particularly pronounced for relatively small messages (e.g., messages that fit within a single message block), which account for the majority of SHA messages processed in enterprise servers. The present disclosure addresses these and other design considerations by efficiently implementing hash functions (including associated message block padding) in a processor.

[0006] In one embodiment, a processor includes an instruction fetch unit for fetching instructions to be executed, a register file including a plurality of registers for storing source operands and target operands, and an execution unit for executing a message fill instruction. The message fill instruction includes an operand field indicating one of a plurality of registers for buffering a message block segment in a message block to be filled, and a mode field indicating which of a plurality of different hash functions is to be applied to the message block. The execution unit includes a fill circuit, which is configured based on the message fill instruction to receive a message block segment from one of a plurality of registers indicated by the operand field of the message fill instruction, wherein the message block spans a plurality of registers in the register file. Based on which of the plurality of different hash functions is indicated by the mode field of the message fill instruction, the fill circuit selects a byte position in the message block segment to insert at least one fill byte at the position, and inserts at least one fill byte at a byte position within the message block segment. The message block segment as filled by the at least one fill byte is then written back to the register file.

[0007] In one embodiment, a data processing method includes acquiring, by an instruction acquisition unit of a processor, an instruction to be executed by the processor, wherein the instruction includes a message fill instruction, which includes an operand field indicating a register of a plurality of registers of a message block segment that buffers a message block to be filled, and a mode field indicating which hash function of a plurality of different hash functions is to be applied to the message block. Based on receiving the message fill instruction, an execution unit of the processor executes the message fill instruction. Executing the message fill instruction includes receiving a message block segment from a register of a plurality of registers indicated by the operand field of the message fill instruction from a register file, wherein the message block spans a plurality of registers in the register file. Based on which hash function of the plurality of different hash functions is indicated by the mode field of the message fill instruction, a byte position in the message block segment is selected to insert at least one fill byte at the byte position, and at least one fill byte is inserted at the byte position within the message block segment. The message block segment as filled by the at least one fill byte is written back to the register file.

[0008] In one embodiment, the message block comprises a plurality of message block segments, and the execution unit is configured to detect which message block segment of the plurality of message block segments the message block segment is based on an indication in the mode field.

[0009] In one embodiment, the multiple different hash functions include a first hash function and a second hash function, and the execution unit is configured to insert both end of message (EOM) padding and end of block (EOB) padding in the message block segment based on the mode field indicating the first hash function, and is configured to insert EOM padding without inserting EOB padding in the message block segment based on the mode field indicating the second hash function.

[0010] In one embodiment, the operand field of the message fill instruction indicates one of a plurality of registers for a length parameter of the buffered message segment, the execution unit being configured to interpret the length parameter differently based on which of a plurality of hash functions is indicated by the mode field.

[0011] In one embodiment, the at least one padding byte includes an end-of-message (EOM) padding byte, selecting the byte position includes generating an EOM enable vector having a length corresponding to the message block segment, and inserting the at least one padding byte includes inserting the EOM padding byte at the byte position in the message block segment based on the EOM enable vector.

[0012] In one embodiment, the fill circuitry includes selection circuitry that selects the value of the EOM fill byte based on which of a plurality of different hash functions is indicated by a mode field of the fill instruction.

[0013] In one embodiment, the register file is a first register file including a first plurality of registers, the processor includes a second register file including a second plurality of registers, each second register having a length smaller than a length of a register in the first plurality of registers, and the execution unit is further configured to combine a plurality of data blocks of the message block segment in a plurality of registers among the second plurality of registers, and transfer all of the data blocks in the plurality of data blocks to a register in the first plurality of registers to form the message block segment.

[0014] In one embodiment, the processor is further configured to insert end of block (EOB) padding in one of the plurality of registers in the second plurality of registers prior to transferring the plurality of data blocks to one of the first plurality of registers.

[0015] In one embodiment, the at least one pad byte includes an end-of-block (EOB) pad byte, selecting the byte position includes generating an EOB enable vector having a length corresponding to the message block segment, and inserting the at least one pad byte includes inserting the EOB pad byte at the byte position in the message block segment based on the EOB enable vector.

[0016] In one embodiment, inserting at least one stuff byte includes logically combining an EOB stuff byte with an end of message (EOM) stuff byte.

[0017] In one embodiment, the execution unit comprises a hash circuit configured, based on a hash instruction, to apply a hash function from among the SHA hash function family to the padded message block comprising the message block segment as padded.

[0018] In one embodiment, the message block segment is a portion of a message comprising a plurality of message blocks having the same length of r bits, such as the padded message block comprises r bits and each register of the plurality of registers has a length less than r bits. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 is a high-level block diagram of a data processing system including a processor according to one embodiment;

[0020] Figure 2 is a high-level block diagram of a processor core according to one embodiment;

[0021] Figure 3 is a high-level block diagram of an exemplary execution unit of a processor core according to one embodiment;

[0022] Figure 4 is a more detailed block diagram of an accelerator unit within a processor core according to one embodiment;

[0023] Figure 5 It is a space-time graph of message hashing that complies with the SHA-3 standard;

[0024] Figure 6 yes Figure 5 The spatiotemporal diagram of the absorption phase shown in ;

[0025] Fig. 7A yes Figure 6 The space-time diagram of the SHA3 permutation function shown in;

[0026] Figure 7B yes Fig. 7A The space-time diagram of the SHA3 round function depicted in;

[0027] Figure 8 yes Figure 5 The time-space diagram of the SHA3 / SHAKE squeeze phase shown in;

[0028] Figures 9 and 10 An exemplary format for a SHA3 hash instruction and a bitwise exclusive OR (XOR) instruction are shown, respectively, according to one embodiment;

[0029] Fig.11 is a high-level block diagram of an exemplary SHA3 / SHAKE hash circuit according to one embodiment;

[0030] Fig.12 is a high-level logic flow diagram of an exemplary process by which a processor executes a SHA3 hash instruction according to one embodiment;

[0031] Fig.13 Depicts a space-time graph of message hashing that complies with the SHA-2 standard;

[0032] Fig.14 yes Fig.13 The space-time diagram of the SHA2 block hash function shown in;

[0033] Fig.15 shows a message extension for a SHA2 hash function with 32-bit words according to an exemplary embodiment;

[0034] Fig.16 depicts an exemplary format for a SHA2 hash instruction according to one embodiment;

[0035] Fig.17 is a high-level block diagram of an exemplary SHA2 hash circuit according to one embodiment;

[0036] Fig.18 According to one embodiment, Fig.17 A high-level block diagram of an exemplary update working status circuit of;

[0037] Fig.19 Yes Fig.18 A high level block diagram of an exemplary embodiment of a SHA2 product circuit as shown in FIG.

[0038] Fig. 20 is a high-level logic flow diagram of an exemplary process by which a processor executes a SHA2 hash instruction according to one embodiment;

[0039] Fig.21A An exemplary unpopulated message is depicted;

[0040] Fig.21B An exemplary fill message is shown;

[0041] FIG. 22A to FIG. 22B depicts a process of combining data blocks of a message block in a narrower first register file and transferring all of the data blocks in the plurality of data blocks to a wider second register file;

[0042] FIG. 23A to FIG. 23D Various padding scenarios for SHA3 / SHAKE messages are shown;

[0043] FIG. 24A to FIG. 24D Describes various padding scenarios for SHA2 messages;

[0044] Fig.25 shows an exemplary fill instruction according to one embodiment;

[0045] Fig.26 depicts an exemplary fill circuit according to one embodiment;

[0046] Fig. 27An exemplary circuit for associating an end of block (EOB) byte and an end of message (EOM) byte with a message is shown according to one embodiment;

[0047] Fig.28 is a high-level logic flow diagram of an exemplary process for populating a message block according to one embodiment; and

[0048] Fig.29 An exemplary design process according to one embodiment is depicted. DETAILED DESCRIPTION

[0049] Referring now to the drawings, and in particular to Figure 1 , which shows a high-level block diagram of a data processing system 100 according to one embodiment. In some implementations, for example, data processing system 100 may be a server computer system (such as one of the POWER series servers from International Business Machines Corporation), a mainframe computer system, a mobile computing device (such as a smart phone or tablet), a laptop or desktop personal computer system, or an embedded processor system.

[0050] As shown, the data processing system 100 includes one or more processors 102 that process instructions and data. Each processor 102 can be implemented as a corresponding integrated circuit having a semiconductor substrate in which the integrated circuit is formed, as is well known in the art. In at least some embodiments, the processor 102 can generally implement any of a variety of commercially available processor architectures, such as POWER, ARM, Intel x86, NVIDIA, Apple Silicon, etc. In the depicted example, each processor 102 includes one or more processor cores 104 and a cache memory 106 that provides low-latency access to instructions and operands that may be read and / or written by the processor core 104. The processors 102 are coupled for communication by a system interconnect 110, which in various implementations may include one or more buses, switches, bridges, and / or hybrid interconnects.

[0051] Data processing system 100 may also include a number of other components coupled to system interconnect 110. For example, these components may include a memory controller 112 that controls access to system memory 114 by processor 102 and other components of data processing system 100. Additionally, data processing system 100 may include an input / output (I / O) adapter 116 for coupling one or more I / O devices to system interconnect 110, a non-volatile storage system 118, and a network adapter 120 for coupling data processing system 100 to a communication network (e.g., a wired or wireless local area network and / or the Internet).

[0052] Those skilled in the art will also appreciate that Figure 1 The data processing system 100 shown in FIG. 1 may include many additional components that are not shown. Since these additional components are not necessary for understanding the described embodiments, Figure 1 However, it should also be understood that the improvements described herein are applicable to data processing systems and processors of various architectures and are by no means limited to Figure 1 The general data processing system architecture shown in .

[0053] Reference now Figure 2 , which depicts a high-level block diagram of an exemplary processor core 200 according to one embodiment. The processor core 200 may be used to implement Figure 1 Any processor core among 10 4 of the processor cores.

[0054] In the depicted example, processor core 200 includes an instruction fetch unit 202 for fetching instructions from storage device 230 (eg, which may include instructions from Figure 1 The processor core 200 may further include one or more operand fields that directly specify operands, or implicitly or explicitly reference one or more registers storing (multiple) source operands to be executed in the execution of the instruction, and one or more registers for storing (multiple) target operands generated by the execution of the instruction. The instruction decoding unit 204, which may be merged with the instruction fetch unit 202 in some embodiments, decodes the instructions fetched from the storage device 230 by the instruction fetch unit 202, and forwards the branch instructions that control the execution flow to the branch processing unit 206. In some embodiments, the processing of the branch instruction performed by the branch processing unit 206 may include speculating on the results of the conditional branch instruction. The results of branch processing (including speculative and non-speculative processing) by branch processing unit 206 may in turn be used to redirect one or more instruction fetch streams by instruction fetch unit 202 .

[0055] The instruction decode unit 204 forwards instructions that are not branch instructions (commonly referred to as "sequential instructions") to the mapper circuit 210. The mapper circuit 210 is responsible for allocating physical registers within the register file of the processor core 200 as needed to support the execution of the instructions. The mapper circuit 210 preferably implements register renaming. Thus, for at least some classes of instructions, the mapper circuit 210 establishes a temporary mapping between a set of logical (or architectural) registers referenced by the instruction and a larger set of physical registers within the register file of the processor core 200. Thus, the processor core 200 can avoid unnecessary serialization of instructions that are not data dependencies, which may otherwise occur due to the reuse of a limited set of architectural registers by instructions that are adjacent in program order.

[0056] Still reference Figure 2 , the processor core 200 also includes a dispatch circuit 216 that is configured to ensure that any data dependencies between instructions are observed and to dispatch consecutive instructions when the instructions are ready for execution. Instructions dispatched by the dispatch circuit 216 are temporarily buffered in an issue queue 218 until an execution unit of the processor core 200 has resources available to execute the dispatched instructions. The issue queue 218 opportunistically distributes instructions from the issue queue 218 to the execution units of the processor core 200 as appropriate execution resources become available, and possibly out of order with respect to the original program order of the instructions.

[0057] In the depicted example, the processor core 200 includes a plurality of different types of execution units for executing respective different classes of instructions. In this example, the execution units include one or more fixed-point units 220 for executing instructions that access fixed-point operands, one or more floating-point units 222 for executing instructions that access floating-point operands, one or more load-store units 224 for loading data from and storing data to a storage device 230, and one or more vector-scalar units 226 for executing instructions that access vector and / or scalar operands. In a typical embodiment, each execution unit is implemented as a multi-stage pipeline, in which multiple instructions can be processed simultaneously at different execution stages. Each execution unit preferably includes or is coupled to access at least one register file, which includes a plurality of physical registers for temporarily buffering operands accessed or generated by the execution of instructions.

[0058] Those skilled in the art will appreciate that processor core 200 may include additional components not shown, such as logic configured to manage the completion and retirement of instructions that complete execution by execution units 220 through 226. Because these additional components are not necessary for an understanding of the described embodiments, they are not described herein. Figure 2are not shown or discussed further in this article.

[0059] Reference now Figure 3 , which shows a high-level block diagram of an exemplary execution unit of processor 102 according to one embodiment. In this example, the vector-scalar unit 226 of processor core 200 is shown in more detail. Figure 3 In the embodiment of the present invention, the vector-scalar unit 226 is configured to execute multiple different categories of instructions that operate on different types of operands and generate different types of operands. For example, the vector-scalar unit 226 is configured to execute a first category of instructions that operate on vector and scalar source operands and generate vector and scalar destination operands. The vector-scalar unit 226 executes instructions in the first category of instructions in functional units 302 to 312, which in the depicted embodiment include an arithmetic logic unit / rotation unit 302 for performing addition, subtraction, and rotation operations, a multiplication unit 304 for performing binary multiplication, a division unit 306 for performing binary division, an encryption unit 308 for performing encryption functions, a permutation unit 310 for performing operand permutations, and a binary coded decimal (BCD) unit 312 for performing decimal mathematical operations. The vector and scalar source operands on which these operations are performed, and the vector and scalar destination operands generated by these operations, are buffered in physical registers of the architectural register file 300 .

[0060] In this example, the vector-scalar unit 226 is also configured to execute a second category of instructions that cause hash functions to be performed. The vector-scalar unit 226 executes instructions in the second category of instructions in the accelerator unit 314. Operands on which these hash functions are performed and operands generated by these hash functions are buffered and accumulated in a wide vector register file 316, which may include, for example, 1024-bit wide physical registers.

[0061] In operation, an instruction is received by the vector-scalar unit 226 from the issue queue 218. If the instruction belongs to the first category of instructions (e.g., vector-scalar instructions), the mapping between logical registers and physical registers established by the mapper circuit 210 is utilized to access the (multiple) relevant source operands for the instruction in the architectural register file 300, and the instruction is then forwarded to the corresponding functional unit of the functional units 302 to 312 for execution. The (multiple) target operands generated by the execution are then stored back to the (multiple) physical registers of the architectural register file 300 determined by the mapping relationship established by the mapper circuit 210. On the other hand, if the instruction belongs to the second category of instructions (e.g., (hash instructions), the instruction is forwarded to the accelerator unit 314 for execution relative to the operands buffered in the registers specified in the wide vector register file 316.

[0062] Reference now Figure 4 , which shows a schematic diagram according to an embodiment Figure 3 314. The accelerator unit 314 includes circuitry for performing a variety of hash functions in hardware, including, for example, one or more hash functions defined by the SHA family of standards. In the depicted example, the hash circuitry of the accelerator unit 314 includes at least a SHA3 / SHAKE hash circuit 400 (described below with reference to Fig.11 ) and SHA2 hash circuit 402 (described in more detail below with reference to Fig.17 314). The accelerator unit 314 also includes a single instruction multiple data (SIMD) exclusive OR (XOR) circuit 404, which is employed in performing SHA3 / SHAKE hashing of messages, as discussed further below. Finally, the accelerator unit 314 includes a data transfer circuit 406, which transfers data (e.g., messages to be hashed and message digests) between the memory system (e.g., cache memory 106 and system memory 114) and the wide vector register file 316.

[0063] Now refer to Figure 5 , which is a time-space diagram of the process 500 of message hashing in accordance with the SHA-3 standard. As is known in the art, the SHA-3 standard (i.e., FIPS 202) uses a sponge structure based on a wide random function or random permutation. According to this sponge structure, a message 502 of arbitrary length (possibly up to several megabytes) is first processed in an input stage, which is referred to in sponge terms as the SHA3 absorption stage 504. Figure 6The SHA3 absorption phase 504 described in detail is the same for both the SHA3 and SHAKE hash functions. The SHA3 absorption phase 504 produces a 1600-bit final absorption state 610, which is then processed in the output phase (referred to in sponge terms as the SHA3 / SHAKE squeeze phase 506) to generate a message digest 508. Figure 8 The SHA3 / SHAKE squeeze phase 506 described in detail operates differently for the SHA3 hash function and the SHAKE hash function. In particular, the SHA3 / SHAKE squeeze phase 506 generates a fixed-length message digest 508 for various SHA3 hash functions, but generates a variable-length message digest 508 for the SHAKE hash function.

[0064] Table I below summarizes the properties of the four SHA3 hash functions and two SHAKE hash functions defined by the SHA-3 standard and listed in the first column. In Table I, the second column summarizes the message block sizes in bits (r) into which the variable length message 502 is split by the SHA3 absorption phase 504. The message block size r is an integer multiple of bytes in length, and the first message block of each message is byte aligned. The third column of Table I summarizes the size in bits (d) of the message digest 508 output by the SHA3 / SHAKE squeeze phase 506. It should be noted again that, unlike the SHA3 hash function, SHAKE-128 and SHAKE-256 generate variable length digests of length d'. As stated in the fourth column of Table I, for each hash function specified by the SHA-3 standard, the final absorbed state 610 is 1600 bits in length. The fifth column of Table I specifies different values ​​of c, multiple low-order bit numbers passed between iterations of the SHA3 state permutation function during the SHA3 / SHAKE squeeze phase 506 (e.g., see Figure 8 ). Finally, the sixth column of Table I specifies that each iteration of the SHA3 state permutation function applies 24 rounds of permutations to each message block (see, for example, Fig. 7A In updates or non-standard implementations of the SHA-3 standard, the number of permutation rounds may be different, for example, by reducing the number of permutations required (e.g., to 12 rounds).

[0065] Table I

[0066]

[0067]

[0068] Reference now Figure 6 , which depicts Figure 5. As shown, the SHA3 absorption stage 504 receives as input a message 502 of arbitrary length. As shown in box 600, the message 502 is padded to obtain a length that is an integer multiple of r bits. In many prior art implementations, this padding is accomplished via a high-latency, computationally expensive memory-to-memory move of the entire message 502. In some other prior art implementations, the SHA hash software routine pads the message block after loading the message block into a SIMD register using a series of conventional SIMD instructions. Although these prior art techniques can be used herein to perform padding, as described below with reference to FIG. Figures 21A to 27 As described in detail, in accordance with the disclosed invention, such padding can also be efficiently performed by hardware in processor registers (e.g., wide vector register file 316) by executing pad instructions. Padding message 502 by executing pad instructions also allows padding to be applied to the end of message 502 in a temporally overlapping manner while processing a block of the message in SHA3 absorption stage 504.

[0069] In the SHA3 absorption phase 504, each of the n (n is a positive integer) message blocks of length r including the padding message is extracted and then zero-extended at the end of the low-order bits to form n 1600-bit extended message blocks 602. The first message block, message block 1602, forms the input to the SHA3 state permutation function 604 defined by the SHA-3 standard. As described below with reference to Fig. 9 and Fig.11 As described, in accordance with one aspect of the disclosed invention, the SHA3 state permutation function 604 is implemented in hardware by executing SHA3 hash instructions. The 1600-bit state output of the SHA3 state permutation function 604 forms a first input to a 1600-bit bitwise XOR function 606, which takes a second input as the next 1600-bit extended message block 602 of the padding message. The result of the bitwise XOR function 606 forms the input to the next iteration of the SHA3 state permutation function 604. As shown, this process is iteratively performed for each message block in the message block 602 until the last iteration of the SHA3 state permutation function 604 generates and outputs a 1600-bit final absorbed state 610, as previously described in Figure 5 as stated in the description.

[0070] Reference now Fig. 7A , which shows Figure 6. The SHA3 permutation function 604 shown in FIG. 6 is a time-space diagram of the SHA3 permutation function 604. The SHA3 permutation function 604 receives a 1600-bit input and then processes the 1600-bit input in conjunction with the round index 0 702 specified by the SHA-3 standard in the first of 24 rounds of the SHA3 round function 704. The process is iteratively performed with each subsequent round of processing in the SHA3 round function 704 receiving the 1600-bit output of the previous SHA3 round function 704 as input and the round index 702 (which is a constant) specified by the relevant SHA3 standard as input. After the 24 rounds of processing within the SHA3 state permutation function 604 are completed, the SHA3 state permutation function 604 outputs a 1600-bit state, which either serves as an input to a bitwise XOR function 606, or serves as a final absorption state 610 that serves as an input to the SHA3 / SHAKE squeeze stage 506 in the case of the last iteration of the SHA3 state permutation function 604 within the SHA3 absorption stage 504.

[0071] Reference now Figure 7B , which depicts Fig. 7A . As shown, the SHA3 round function 704 includes a sequence of functions specified by the SHA-3 standard, which are represented in sequence by the Greek letters θ (theta), ρ (rho), π (pi), χ (chi), and The theta function receives and processes the 1600-bit input to the round function 704, and the output of each function except the iota function feeds the next sequential function. Finally, the iota function processes the output of the chi function and the associated round index 702 to produce the 1600-bit output for a given iteration of the SHA3 round function 704. In the prior art, executing the round function 704 may take up to 80 cycles using two single instruction multiple data (SIMD) vector pipelines. According to one aspect of the invention disclosed herein, the round function 704 may be executed in a manner similar to that described below. Fig.11 The SHA3 / SHAKE hash circuit 400 is completed within a single cycle of the processor core 104 .

[0072] Reference now Figure 8 , which shows Figure 51 , a time-space diagram of the SHA3 / SHAKE squeeze phase 506 is shown. As previously described, the SHA3 / SHAKE squeeze phase 506 receives as input the 1600-bit final absorption phase 610 produced by the SHA3 absorption phase 504. To produce a message digest 508 of any SHA3 function defined by the SHA-3 standard, the SHA3 / SHAKE squeeze phase 506 first takes the first r high-order bits of the final absorption state 610 to form a result block 1 800. Then, the truncation function 802 truncates the r bits of the result block 1 800 to retain the high-order d bits to form the message digest 508.

[0073] To generate a message digest for one of the SHAKE functions defined by the SHA-3 standard, the r bits of result block 1 800 form the r high-order bits of the input to truncation function 804. These r high-order bits are concatenated with n-1 additional r-bit result blocks 800, each of which is formed as described previously with respect to Fig. 7A The r high-order bits of the output of the described iteration of the SHA3 state permutation function 604 are formed. Each SHA3 state permutation function 604 of the SHA3 / SHAKE squeeze stage 506 receives a 1600-bit input (i.e., r+c=1600) and generates a 1600-bit output, which, except for the last iteration of the SHA3 state permutation function 604, feeds the subsequent iteration of the SHA3 state permutation function 604. The truncation function 804 truncates the r×n input bits to obtain a message digest 508 with a user-specified d′ bit length.

[0074] Reference now Figures 9 and 10 , which shows exemplary formats for a SHA3 hash instruction 900 and a bitwise exclusive OR (XOR) instruction 1000, respectively, according to one embodiment. In an exemplary embodiment, the accelerator unit 314 is configured to, in response to receiving the SHA3 hash instruction 900, perform the SHA3 / SHAKE state permutation function in hardware using the SHA3 / SHAKE hash circuit 400, and in response to receiving the bitwise XOR instruction 1000, perform a 1024-bit bitwise XOR of the specified operand using the SIMD XOR circuit 404.

[0075] In the illustrated embodiment, the SHA3 hash instruction 900 includes an opcode field 902, which specifies the opcode specified for the specific architecture of the SHA3 / SHAKE permutation function. The SHA3 hash instruction 900 also includes one or more register fields 904, 906, which are used to specify the registers in the wide vector register file 316, for the source and target operands of the SHA3 / SHAKE state permutation function. For example, in one implementation, the SHA3 hash instruction 900 includes a single register field 904, which specifies the first register in a pair of adjacent 1024-bit registers, which buffers 1600-bit source operands, and after completing the SHA3 / SHAKE permutation function, specifies a 1600-bit target operand (which rewrites the source operand). In an alternative implementation, the SHA3 hash instruction 900 includes two register fields 904, 906, which are used to specify a separate pair of 1024-bit source and target registers (in this case, the target operand does not cover the source operand).

[0076] As described above, in future updates to the SHA-3 standard or in non-standard implementations, it may be desirable to control the number of permutation rounds applied by the SHA3 state permutation function 604. In such embodiments, the number of rounds SHA3 hash instruction 900 may include a field that directly sets the number of permutation rounds or references a register that specifies the number of permutation rounds.

[0077] Fig.10 An exemplary embodiment is shown in which the bitwise XOR instruction includes an opcode field 1002 that specifies a specific architecture-specific opcode for a 1024-bit bitwise XOR function. The bitwise XOR instruction 1000 additionally includes three register fields 1004, 1006, and 1008 for respectively specifying 1024-bit registers within the wide vector register file 316 for buffering two 1024-bit source operands and one 1024-bit destination operand.

[0078] Now that the SHA3 and SHAKE hash functions and exemplary instructions for implementing portions of these hash functions have been explained, pseudocode for performing an exemplary SHA3 hash function in hardware is given. In the pseudocode that follows, the following registers are referenced:

[0079] Rr←block length in bytes

[0080] RL←message length in bytes / / Assume RL≥Rr & the first block is not padded

[0081] Ra←the starting address of the message

[0082] Rb←the address of the message digest obtained from the hash function

[0083] Rd ← message digest length in bytes

[0084] Xs←SHA3 state / / wide vector register pair

[0085] Xm←Message block / / Wide vector register pair

[0086] Given these registers, pseudocode for any of the SHA3 (non-SHAKE) hash functions can be expressed as follows:

[0087] Xs = loadlength (Ra, Rr) / / load the first message block and initial state of the message

[0088] Xs = sha3hash (Xs) / / execute SHA3 hash instruction to perform permutation on it

[0089] / / First message block

[0090] RL-=Rr / / Decremental length of the unprocessed portion of the message

[0091] Ra+=Rr / / Increment pointer of the next message block in the message

[0092] While(RL>=Rr) / / Enter a loop to process each remaining message block,

[0093] / / Messages other than the message block of the last message

[0094] {Xm=loadlength(Ra,Rr) / / load the next message block

[0095] Xs = wide_xor (Xs, Xm) / / Execute bitwise XOR instruction to combine status and

[0096] / / Current message block

[0097] Xs = sha3hash (Xs) / / execute SHA3 hash instruction to perform permutation on it

[0098] / / Current message block

[0099] RL-=Rr / / Decremental length of the unprocessed portion of the message

[0100] Ra+=Rr / / Increment pointer of the next message block

[0101] }

[0102] Xm = loadlength (Ra, RL) / / load the last message block, if it exists (RL can be zero)

[0103] Xm = sha3_padding (Xm, RL, sha3-type) / / execute padding instructions to fill

[0104] / / Message based on remaining messages

[0105] / / Length and SHA3 function

[0106] Xs = wide_xor (Xs, Xm) / / Execute bitwise XOR instruction to combine status and

[0107] / / Last block of information

[0108] Xs = sha3hash (Xs) / / execute SHA3 hash instruction to perform permutation on it

[0109] / / The last information block generates the final absorption state

[0110] Store_length(Xs,Rb,Rd) / / In the SHA3 squeeze phase, truncate the last absorption

[0111] / / State, forming the message digest by storing the leading Rd

[0112] / / Xs at address Rb to byte in memory

[0113] Reference now Fig.11 , shows a high-level block diagram of an exemplary SHA3 / SHAKE hash circuit 400 suitable for executing a SHA3 hash instruction 900 according to one embodiment. As shown, the SHA3 / SHAKE hash circuit 400 includes two 1024-bit dual-input multiplexers 1100a, 1100b, two 1024-bit state registers 1102a, 1102b, a SHA3 round circuit 1106, and a control circuit 1110 for controlling the operation of the SHA3 / SHAKE hash circuit 400 in response to the SHA3 hash instruction 900.

[0114] Input multiplexer 1100a has a first input coupled to receive the high-order 1024 bits of the 1600-bit input state from the first register of the register pair in the wide vector register file 316 identified by the SHA3 hash instruction 900, and a second input coupled to receive the high-order 1024 bits of the 1600-bit round feedback from the SHA3 round circuit 1106. Input multiplexer 1100b is similarly constructed, having a first input coupled to receive a 1024-bit value including the low-order 576 bits of the 1600-bit input state from the second register of the instruction-specified register pair in the wide vector register file 316, and a second input coupled to the SHA3 round circuit 1106 to receive a 1024-bit value including the low-order 576 bits of the 1600-bit round feedback. The control logic 1110 within the SHA3 / SHAKE hash circuit 400 provides a select signal (not shown) to the input multiplexers 1100a, 1100b, so that the input multiplexers 1100a, 1100b select the value present at their first input before SHA3 round 0, and select the value present at their second input after each of SHA3 rounds 0 to SHA3 round 23, and the values ​​output by the input multiplexers 1100a, 1100b, which are buffered in the status registers 1102a, 1102b, respectively, together form the 1600-bit round input value of the SHA3 round circuit 1106, which is configured to perform the SHA3 round function 704 on the round input value, as previously described with reference to FIG. FIG. 7A to FIG. 7B described.

[0115] The control circuit 1110 is also configured to sequence the SHA3 round circuit 1106 through each of the 24 rounds required by the SHA-3 standard using the correct round index specified by the SHA-3 standard. After the end of round 23, the state registers 1102a, 1102b will respectively save the high-order 1024 bits and low-order 576 bits of the 1600-bit output state. The control circuit 1110 is also configured to assert a select signal not shown once the output state is obtained so that the output multiplexer 1108 writes the high-order and low-order 1600-bit output state from the state registers 1102a, 1102b to the instruction-specified register pair in the wide vector register file 316 in two consecutive cycles (assuming that the wide vector register file 316 has a single write port).

[0116] Reference now Fig.12 , shows a high-level logic flow chart of an exemplary process for executing SHA3 hash instruction 900 according to one embodiment. For ease of understanding, refer to Fig.11 An exemplary SHA3 / SHAKE hash circuit 400 is described Fig.12 process.

[0117] Fig.12 The process begins at block 1200 and then proceeds to block 1202, which shows that the SHA3 / SHAKE hash circuit 400 receives a SHA3 hash instruction 900 that specifies an operand register pair within the wide vector register file 316. In response to receiving the SHA3 hash instruction 900, the control circuit 1110 causes the contents of the operand register pair to be read from the wide vector register file 316 and loaded into the state registers 1102a, 1102b via the input multiplexers 1100a, 1100b (block 1204). The control circuit 1110 additionally initializes the internal round counter to 0 (block 1206).

[0118] The process then proceeds from block 1206 to block 1208, which shows that the control circuit 1110 directs the SHA3 round circuit 1106 to perform iterations of the SHA3 round function 704 using the round inputs buffered in the state registers 1102a, 1102b and the appropriate round index specified by the SHA-3 standard. The control circuit 1110 additionally increments the round counter (block 1208). The processing results of the SHA3 round circuit 1106 are returned to the state registers 1102, 1102b by the input multiplexers 1100a, 1100b. As shown in block 1210, the control logic 1110 causes the SHA3 round circuit 1106 to perform 24 processing rounds specified by the SHA-3 standard using the appropriate round index. When 24 processing rounds are completed, control circuit 1110 asserts the appropriate select signal to cause output multiplexer 1108 to store the 1600-bit state buffered in state registers 1102a, 1102b (as zero extensions in the low-order bits to form two 1024-bit values) into the operand register pair within wide vector register file 316 specified by SHA3 hash instruction 900 (block 1214). Thereafter, Fig.12 The process ends at block 1216.

[0119] Reference now Fig.13 , shows a time-space diagram of a message hash according to the SHA-2 standard (FIPS180-4), which is Figure 4In an embodiment of the present invention, the SHA2 hash circuit 402 performs the hashing operation. Table II below summarizes the properties of the six SHA2 hash functions defined by the SHA-2 standard and listed in the first column. In Table II, the second column summarizes the message block size (r) in bits. The message block size r is an integer multiple of the byte length, and the first message block of the message is byte aligned. The third column of Table II summarizes the fixed size in bits (d) of the message digest obtained from each SHA2 hash function. The fourth column of Table II represents the size in bits of the state of each SHA2 hash function, while the fifth column of Table II indicates the number of processing rounds (i.e., 64 or 80) employed in each SHA2 hash function (see, e.g. Fig.14 ). Finally, the sixth column of Table II specifies the word size used for each SHA2 hash function in bits. Note that for all variants, the state size is 8 times the word size (i.e., includes 8 words), and the message block size is 16 times the word size (i.e., includes 16 words). As described below, according to one aspect of the disclosed invention, as described below with reference to Fig.15 As described, a SHA2 hash function using a 32-bit word size and a SHA2 hash function using a 64-bit word size are processed along the same data stream using message extension of words applied to SHA2-224 and SHA2-256 hash functions.

[0120] Table II

[0121]

[0122] like Fig.13 As shown, the SHA2 hash function 1300 receives as an input a message 1302 of any arbitrary length (e.g., possibly megabytes in length). As shown in block 1304, the message 1302 is padded to obtain a length that is an integer multiple of r bits. Figure 6 As discussed, this padding can be efficiently performed by hardware in processor registers (e.g., wide vector register file 316) rather than by memory moves via execution of pad instructions. Padding message 1302, and in particular, padding the last message block(s) of message 1302 by executing pad instructions, also allows padding to be applied to the end of message 1302 in a manner that overlaps in time with processing of message blocks by SHA2 hash function 1300. Each of the n (n is a positive integer) message blocks of length r (where r=16×w) that make up the padded message produced by block 1304 is extracted to form one of n 16w-bit message blocks 1306.

[0123] In addition to the message 1302, the SHA2 hash function 1300 also receives as input an 8×w bit SHA-2 specified constant value. As is known in the art, this constant value, which can be accessed from the architectural register file 300, varies between SHA2 hash functions and forms an 8×w bit initial state 1308. The initial state 1308 and the first message block, message block 1 1306, form two inputs to the SHA2 block hash function 1 1310 defined by the SHA-2 standard. As described below with reference to Fig.16 and Fig.17 As described, according to one aspect of the disclosed invention, the SHA2 block hash function 1310 is performed in hardware by executing a SHA2 hash instruction. The 8×w bit state output by the SHA2 block hash 1 function 1310 forms the first input of the SHA2 block hash function 2 1310, which takes the next 16×w bit message block 2 1306 as the second input. The result of the SHA2 block hash function 2 130 forms the input of the next iteration of the SHA2 block hash function 1310. As shown, this process continues iteratively for each message block 602 until the last nth iteration of the SHA2 block hash function 1310 generates and outputs an 8×w bit final state, which is truncated by the truncation function 1312 to produce a d-bit message digest 1314.

[0124] Reference now Fig.14 , describes Fig.13 14. The SHA2 block hash function 1310 takes a 16×w-bit message block 1306 and initializes a 16×w-bit message schedule for the message block 1306 as shown in block 1420. The SHA2 block hash function 1310 then processes the 16×w-bit message schedule through n processing rounds in the message schedule round function 1400, where the 16×w-bit output of each of the 1st to n-2nd rounds is used as the input of the next round of message schedule processing.

[0125] As shown, the SHA2 block hash function 1310 also receives an 8×w-bit current hash state (i.e., the initial state 1308 or the output of the previous SHA2 block hash function 1310) as input. As shown in block 1406, the SHA2 block hash function 1310 splits the 8×w-bit current hash state into 8×w-bit variables a to h. The SHA2 block hash function 1310 then processes the current hash state by n processing rounds of the update round function 1404. The initial update round 0 1404 takes the w-bit round key 0 1402 specified by SHA-2 and the w high-order bits of the 16×w-bit initialization 1420 of the message schedule as additional inputs. Each subsequent iteration of the update round function 1404 takes the state generated by the previous iteration of the update round function 1404, the w high-order bits of the 16×w-bit output of the corresponding iteration of the message schedule round function 1400, and the w-bit round key 1402 specified by SHA-2 as input. The hash state output by the update round function n-1 1404 is added to the input hash state by the 8×w-bit carry propagation addition function 1410 to generate the next hash state.

[0126] Reference now Fig.15 , shows a message extension for a SHA2 hash function according to an exemplary embodiment. As shown above with reference to Table II and Fig.13 As described, embodiments of the disclosed invention preferably support processing SHA2 hash functions of different word sizes w along a common data path by extending the message word and the initial hash state of those SHA2 hash functions that employ smaller word sizes. Such extensions may be used, for example, in Fig.13 Blocks 1304 and 1308 are executed, Fig.15 A specific example is shown in which each of the sixteen 32-bit words 1502 of a SHA2-224 or SHA2-256 input message 1500 is expanded to form a corresponding one of the sixteen 64-bit doublewords 1506 of an output message 1504. In this example, each 64-bit doubleword 1506 is formed by concatenating the 32-bit words of the input message 1500 in the high-order half of the 64-bit doubleword 1506 with the 32-bit zero word 1508 in the low-order half of the doubleword 1506. The resulting output message 1504 can then be processed by the SHA2 hash circuit in the same manner as a message using 64-bit words.

[0127] Reference now Fig.16 , shows an exemplary format of a SHA2 hash instruction 1600 according to one embodiment. In an exemplary embodiment, the accelerator unit 314 is configured to perform the SHA2 block hash function 1310 in hardware using the SHA2 hash circuit 402 in response to receiving the SHA2 hash instruction 1600.

[0128] In the illustrated embodiment, the SHA2 hash instruction 1600 includes an opcode field 1602 that specifies a specific architecture-specific opcode for a SHA2 block hash function. The SHA2 hash instruction 1600 additionally includes one or more operand register fields 1604, 1606 for specifying operand registers within the wide vector register file 316 for the source and target operands of the SHA2 block hash function. For example, in one implementation, the SHA2 hash instruction 1600 includes a register field 1604 that specifies a 1024-bit register that buffers the current hash state of the input, and after completing the SHA2 block hash function, buffers the output current hash state (which overwrites the current hash state of the input). In addition, the SHA2 hash instruction 1600 includes a register field 1606 that buffers the current message block to be processed. The SHA2 hash instruction 1600 also includes a mode field 1608 that indicates whether the SHA2 hash function to be performed uses 32-bit words or 64-bit words.

[0129] Now that the SHA2 hash function and exemplary instructions for implementing portions of the SHA2 hash function have been explained, pseudocode for performing an exemplary SHA2 hash function (i.e., SHA2-512) in hardware is presented. In the SHA2-512 hash function, each message block is 1024 bits in length, and the hash state and message digest are both 512 bits in length. In the pseudocode that follows, the following registers are referenced:

[0130] R1←message length in bytes

[0131] RL←message length in bytes; assume RL≥128 bits so the first message block is not padded

[0132] Ra←the starting address of the message

[0133] Ri←the address of the initial state

[0134] Rb←the address of the message digest obtained from the hash function

[0135] Rd ← message digest length in bytes

[0136] Xs←SHA3 state / / wide vector register pair

[0137] Xm←Current message block / / Wide vector register pair

[0138] Given these registers, the pseudocode for performing the SHA3-512 hash function can be expressed as follows:

[0139] Xs=load(Ri,64) / / load the 64-bit initial state

[0140] Xm=load(Ra,128) / / load the first (complete) message block

[0141] Xs = sha2hash (Xs, Xm, 64-bit) / / Execute SHA2 hash instructions to execute the block

[0142] / / Hash function

[0143] RL-=128 / / Decrementing message length to be processed

[0144] Ra+=128 / / Increment pointer to the next message block

[0145] While(RL>=128) / / Loop through the remaining message blocks

[0146] except

[0147] / / Last message block

[0148] {Xm=load(Ra,128) / / load the next message block (full size)

[0149] Xs = sha2hash (Xs, Xm, 64-bit) / / Execute SHA2 hash instructions to execute the block

[0150] / / Hash function

[0151] RL-=128 / / Decrementing message length to be processed

[0152] Ra+=128 / / Increment pointer to the next message block

[0153] }

[0154] Xm = loadlength (Ra, RL) / / load the last message block, if it exists (RL can be zero)

[0155] Xm = sha2_EOM_pad (Xm, RL) / / Add SHA2 EOM bytes to the end of the message

[0156] / / piece

[0157] If(RL>111)then / / If the padding spans two message blocks,

[0158] {Xs=sha2hash(Xs,Xm,64-bit) / / Execute SHA2 hash instructions to execute block Xm=force-to-zero / / Hash function and zero last message block

[0159] }

[0160] Xm = sha2_EOB_pad (Xm, RI) / / Insert EOB into the last block of the padding message

[0161] Xs = sha2hash (Xs, Xm, 64-bit) / / Execute SHA3 hash instructions to execute the block

[0162] / / Hash function on the last message block

[0163] Store(Xs,Rb,64) / / Truncate the state to get 64 bytes of Xs

[0164] / / Message digest and store in memory at address Rb

[0165] Reference now Fig.17 , showing Figure 4 1600, which is suitable for executing the SHA2 hash instruction 1600. As shown, the SHA2 hash circuit 402 includes a 512-bit dual-input state multiplexer 1702a, a 1024-bit dual-input message multiplexer 1702b, a 512-bit state register 1704a, a 1024-bit message block register 1704b, an update working state circuit 1708, a message scheduling round circuit 1710, and a control circuit 1720 for controlling the operation of the SHA2 hash circuit 402 in response to the SHA2 hash instruction 1600.

[0166] In this example, a first input of state multiplexer 1702a is coupled to receive the current hash state held in the 512 high order bits of a register in the wide vector register file 316 specified by register field 1604 of the SHA2 hash instruction 1600. A second input of state multiplexer 1702a is coupled to the output of update working state circuit 1708. Message multiplexer 1702b is similarly configured, having a first input coupled to receive a message block from a register in the wide vector register file 316 specified by register field 1606 of the SHA2 hash instruction 1600, and a second input coupled to receive 1024-bit round feedback from message scheduling round circuit 1710. The control logic 1720 within the SHA2 hash circuit 400 provides a selection signal, not shown, to the multiplexers 1702a and 1702b to cause the multiplexers 1702a and 1702b to select the value present at the first input before updating the round 0 function 1404 and to select the value present at the second input after updating each of the round 0 functions to the SHA2 block hash n functions. The values ​​output by the multiplexers 1702a and 1702b are temporarily buffered in the state register 1704a and the message block register 1704b, respectively. The message blocks buffered in the message block register 1704b form a state register 1704a and a message block register 1704b, respectively. Fig.14 The message scheduling round circuit 1710 input of the message scheduling round function 1400, the 64 high-order bits from the message block register 1704b and the 512-bit state in the state register 1704a form two inputs of the update working state circuit 1708, which is configured to perform as previously referred to. Fig.14 An update round function 1404 is described.

[0167] The control circuit 1720 is also configured to order the update of the working state circuit 1708 through each of the n rounds using the correct round index specified by the SHA-2 standard. After the last round n-1 is completed, the state register 1704a will hold a 512-bit hash state. Once the output hash state is obtained, the control circuit 1720 is also configured to cause the single instruction multiple data (SIMD) adder 1712 to add the hash state from the state register 1704a to the input hash state read from the wide vector register field 316, and store the result as the next hash state back to the wide vector register file 316, as described above with respect to Fig.14 As described above with reference to the addition function 1410, those skilled in the art will appreciate that in different implementations, the SIMD adder 1712 may be implemented as a dedicated component of the SHA2 hash circuit 402, or as a separate pipeline that may be shared by multiple hash circuits, for example.

[0168] Reference now Fig.18, describes a method according to an embodiment Fig.17 1800. A more detailed block diagram of an exemplary update working state circuit 1708 of FIG. 1801 is shown. In this embodiment, the 512-bit state buffered in the state register 1704a, which is received as an input to the update working state circuit 1708, is divided into eight 64-bit variables, referred to as variables a to h in the SHA-2 standard, as shown in block 1800. The update working state circuit 1708 includes two sigma function circuits, namely, SHA2 sigma0 circuit 1802 and SHA2 sigma1 circuit 1806, as well as SHA2 MA circuit 1804 and SHA2 CH circuit 1808, each of which performs a corresponding function defined by the SHA-2 standard. The update working state circuit 1708 also includes three 64-bit adders 1810, 1812, and 1814. SHA2 sigma0 circuit 1802 applies a sigma function with n(n1, n2, n3) = (28, 34, 39) and m(m1, m2, m3) = (2, 13, 22) to variable a to produce a first input to adder 1812. Variables a, b, and c are processed by SHA2 MA circuit 1804 to produce a second input to adder 1812. SHA2 sigma1 circuit 1806 applies a sigma function with n(n1, n2, n3) = (14, 18, 41) and m(m1, m2, m3) = (6, 13, 22) to variable e to produce a first input of five inputs to adder 1810. Variables e, f, and g are processed by SHA2 CH circuit 1808 to produce a second input to adder 1810. Adder 1810 adds the relevant round key, the round message block and the variable d to these two inputs to produce a sum that forms the first input of adder 1814 and the third input of adder 1812.

[0169] Update working state circuit 1708 generates a 512-bit result state 1816 consisting of eight 64-bit variables a' to h'. Variable a' of result state 1816 is formed by the output of adder 1812, variables b', c' and d' are formed by variables a, b and c of input state 1800, respectively, and variables f', f' and h' are formed by variables e, f and g of input state 1800, respectively. The remaining variable e' is formed by the sum of the output of adder 1810 and variable d of input state 1800.

[0170] It should be noted that the above reference Fig.15The described 32-bit to 64-bit extension of the SHA-2 message word does not affect (is transparent to) the design of the SHA2 MA circuit 1804, SHA2 CH circuit 1808 and modular adders 1812, 1814. The trailing zero extension of the SHA2 message using 32-bit words only affects the SHA2simga circuits 1802, 1806, as described below. Fig.19 Describe in more detail.

[0171] Fig.19 is a more detailed block diagram of an exemplary embodiment of a SHA2 simga circuit 1900, which can be used to implement Fig.18 SHA2 simga0 circuit 1802 and SHA2 simga1 circuit 1806. SHA2 sigma circuit 1900 receives a 64-bit input variable 1902 including 32 high-order bits (bits 0 to 31) and 32 low-order bits (bits 32 to 63).

[0172] SHA2 sigma circuit 1900 includes a 64-bit rotation circuit 1904a that rotates the 64-bit input variable 1902 by n1 bits (i.e., 28 bits for SHA2 sigma0 circuit 1802 and 14 bits for SHA2 sigma 1 circuit 1806) to obtain a first 64-bit input to multiplexer 1910a. SHA2 sigma circuit 1900 additionally includes a 32-bit rotation circuit 1906a that rotates the 32 high-order bits of input variable 1902 by m1 bits (i.e., 2 bits for SHA2 sigma0 circuit 1802 and 6 bits for SHA2 sigma1 circuit 1806) to obtain a second 64-bit input to multiplexer 1910a when concatenated with the 32 low-order bits of input variable 1902. Multiplexer 1910a selects between its first input and second input based on a mode signal determined by mode field 1608 of the associated SHA2 hash instruction 1600. That is, multiplexer 1910a selects the first input if the mode signal indicates that mode field 1608 is set to indicate a SHA2 hash function utilizing 64-bit words, and selects the second input if the mode signal indicates that mode field 1608 is set to indicate a SHA2 hash function utilizing 32-bit words.

[0173] SHA2 sigma circuit 1900 additionally includes a 64-bit rotation circuit 1904b that rotates the 64-bit input variable 1902 by n2 bits (i.e., 34 bits for SHA2 sigma0 circuit 1802 and 18 bits for SHA2 sigma1 circuit 1806) to obtain a first 64-bit input to multiplexer 1910b. SHA2 sigma circuit 1900 also includes a 32-bit rotation circuit 1906b that rotates the 32 high-order bits of input variable 1902 by m2 bits (i.e., 13 bits for both SHA2 sigma0 circuit 1802 and SHA2 sigma 1 circuit 1806) to obtain a second 64-bit input to multiplexer 1910b when concatenated with the 32 low-order bits of input variable 1902. Multiplexer 1910b selects between its first and second inputs based on a mode signal. In particular, if the mode signal indicates that the mode field 1608 is set to indicate a SHA2 hash function using a 64-bit word, the multiplexer 1910b selects the first input, and if the mode signal indicates that the mode field 1608 is set to indicate a SHA2 hash function using a 32-bit word, the second input is selected.

[0174] SHA2 sigma circuit 1900 also includes a 64-bit rotate / shift circuit 1908a that rotates and shifts the 64-bit input variable by n3 bits (i.e., 39 bits for SHA2 sigma0 circuit 1802 and 41 bits for SHA2 sigma1 circuit 1806) to obtain a first 64-bit input to multiplexer 1910c. SHA2 sigma circuit 1900 additionally includes a 32-bit rotate / shift circuit 1908b that rotates and shifts the 32 high-order bits of input variable 1902 by m3 bits (i.e., 22 bits for both SHA2 sigma0 circuit 1802 and SHA2 sigma1 circuit 1806) to obtain a second 64-bit input to multiplexer 1910c when concatenated with the 32 low-order bits of input variable 1902. Multiplexer 1910c selects between its first and second inputs based on a mode signal. As with multiplexers 1910a and 1910b, multiplexer 1910c selects the first input if the mode signal indicates that the mode field 1608 is set to indicate a SHA2 hash function utilizing a 64-bit word, and selects the second input if the mode signal indicates that the mode field 1608 is set to indicate a SHA2 hash function utilizing a 32-bit word.

[0175] The 64-bit outputs of multiplexers 1910a, multiplexer 1910b, and multiplexer 1910c form the inputs of a three-input 64-bit bitwise XOR circuit 1912, which performs a bitwise XOR on its three inputs to generate a 64-bit output 1914. Those skilled in the art will appreciate that in some embodiments of the SHA2 sigma circuit 1900, the functionality of the rotation circuits 1904a-1904b and 1906a-1906b and the rotation / shift circuits 1908a-1908b may be implemented by appropriate wiring, thereby allowing the SHA2 sigma circuit 1900 to be implemented using three multiplexers 1910a-1910c and a 3-way bitwise XOR circuit 1912 without explicit rotation and shift circuits.

[0176] Reference now Fig. 20 , shows a high-level logic flow diagram of an exemplary process for executing the SHA2 hash instruction 1600 according to one embodiment. For ease of understanding, refer to Figure 17-Figure 19 The exemplary embodiment of the SHA2 hash circuit 402 shown in FIG. Fig. 20 process.

[0177] Fig. 20 The process begins at block 2000 and then proceeds to block 2002, which shows that the SHA2 hash circuit 402 receives a SHA2 hash instruction 1600 that specifies a particular SHA2 mode (i.e., a 32-bit or 64-bit word size) and a state and message block register within the wide vector register file 316. In response to receiving the SHA2 hash instruction 1600, the control circuit 1720 causes the 512-bit state and 1024-bit message block to be read from the wide vector register file 316 and loaded into the state register 1704a and the message block register 1704b via multiplexers 1702a and 1702b, respectively (block 2002). The control circuit 1720 additionally initializes the internal round counter to 0 (block 2004).

[0178] Then, the process proceeds from block 2004 to block 2006, which shows that the control circuit 1720 directs the message scheduling round circuit 1710 to perform iterations of the message scheduling round function 1400 using the message blocks buffered in the message block register 1704b. In addition, the control circuit 1720 directs the update working state circuit 1708 to perform iterations of the update round function 1404 based on the appropriate round index, the 64 high-order bits of the message block register 1704b, and the input hash state from the state register 1704a. The processing results of the update working state circuit 1708 and the message scheduling round circuit 1710 are returned to the registers 1704a and 1704b by the multiplexers 1702a and 1702b, respectively. The control circuit 1110 additionally advances the round counter. At block 2010, the control logic 1720 determines whether the SHA2 hash circuit 402 has performed the last few processing rounds specified by the SHA-2 standard by referring to the round counter. As shown in Table II, the SHA2 hash circuit 402 performs 64 processing rounds for the SHA2 hash function using 32-bit words and 80 processing rounds for the SHA2 hash function using 64-bit words. If the control circuit 1720 determines at block 2010 that at least one additional processing round remains to be performed, the process returns to block 2006, which has been described. However, in response to determining at block 2010 that all processing rounds are complete, the control circuit 1720 causes the previous state to be read again from the wide vector register file 316 and added by the SIMD adder 1712 to the final state buffered in the state register 1704a (block 2012). The control circuit 1720 then directs the storage of the resulting next state back to the wide vector register file 316 (block 2014). Thereafter, Fig. 20 The process ends at block 2016.

[0179] As above reference Figure 6 Block 600 and Fig.13 As discussed in block 1304, messages processed by the SHA2 and SHA3 hash functions are padded to create a message whose length is an even multiple of the block length r bits. Fig.21A An exemplary unfilled message 2100 is described, which has a total length of L bits and includes n message blocks. Of these message blocks, the first n-1 message blocks include r bits, but the last message block n includes k bits, where k < r. Fig.21B As shown, in general, message 2100 is padded by appending rk padding bits to the end of message block n, thereby generating n message blocks with a total length of r bits.

[0180] The content of the padding bits appended to obtain a padded message may vary depending on the hash function under consideration. For example, in the SHA2 and SHA3 / SHAKE hash algorithms discussed herein, the padding bits will include bytes marking the end of the unfilled portion of the message (i.e., the end of message (EOM) marker) and the end of the last block of the padded message (i.e., the end of block (EOB) marker). As further explained below, in some cases, the padding bits including the EOM and EOB markers may all be included within the message block containing the last message bytes; in other cases, adding padding bits may require adding additional message blocks to the message. In either case, the disclosed invention preferably performs message padding in a processor register by executing one or more instructions rather than by a high-latency memory move operation to transfer a message between two locations in a memory.

[0181] In at least some architectures, the load-store unit 224, memory controller 112, and / or system interconnect 110 are not configured to support data transfers of long data objects (e.g., complete r-bit SHA3 / SHAKE and SHA2 message blocks) between the system memory 114 and the wide vector register file 116. In such architectures, the message blocks are transferred into a narrower register file in multiple smaller data blocks, and then transferred from the narrower register file into one or more wide vector registers of the wide vector register file 316. For example, Fig.22A An example is shown in which a SHA3 / SHAKE message block n is assembled in a register file 300 of an architecture including 256-bit registers r0 to rS 301. In this example, for example, Figure 2The load-store unit 224 executes a load-length instruction to load five 256-bit data blocks of the 1152-bit SHA3-224 message block n into registers r0 to r7 and zero any register bytes that do not contain message data. Given the 1152-bit length of the message block in SHA3-224, the message bytes within message block n will at most completely fill registers r0 to r3 plus the first 128 bits of register r4 (of course, the last message block that is not filled with the message may contain less than r bits). Register r4 and at least the remaining 128 bits of all registers r5 to r7 can be automatically zeroed by executing the load-length instruction or by executing the standard load instruction. (Registers r6 and r7 need only be filled with zeros for the general SHA3 function that is applicable to any supported message block length). Additional data transfer instructions may then be executed by the data transfer circuitry 406 or transfer unit 320 to transfer the contents of registers r0 to r7 to registers R0 and R1 317 of the wide vector register file 316, which includes registers R0 to RT, each having an exemplary width of 1024 bits as described above. In an alternative implementation, the same result may be achieved by loading four registers 301 within the architectural register file 300 to buffer data blocks n1 to n4, and then reusing the same registers 301 in subsequent cycles to buffer data blocks n5 to n8.

[0182] Fig. 22B A similar example is described, showing the transfer of a 1024-bit SHA2 message block n to a wide vector register 317 in a wide vector register file 316 after the message block is assembled into register 301 of the architectural register file 300. In this example, for example, Figure 2 The load-store unit 224 of the SHA2 memory executes a load-length instruction to load four 256-bit blocks of SHA2 message block n into registers r2 through r5 of the architectural register file 300 and zero any register bytes that do not contain message data. The data transfer circuit 406 may then execute additional data transfer instructions to transfer the contents of registers r2 through r5 to register R0 317 of the wide vector register file 316. In an alternative implementation, the same result may be achieved by loading two registers 301 within the architectural register file 300 to buffer data blocks n1 and n2, and then reusing the same register 301 in a subsequent cycle to buffer data blocks n3 through n4.

[0183] In at least some preferred embodiments, for all message blocks of a SHA3 / SHAKE or SHA2 message, including message block n which is the last message block of an unfilled message, perform Figure 22A-22BThe process for loading a message block into the wide vector register file 316 is given in . As described below, the end of the message can then be filled, at least in part, in the wide vector register file 316 by executing one or more instructions.

[0184] Figure 23A-23D Various padding scenarios for SHA3 / SHAKE messages of various lengths are shown. According to the SHA-3 standard, each message must include EOM padding that marks EOM. Under the SHA3 standard, EOM padding has a fixed value of x06 for the SHA3 hash function and a fixed value of x1F for the SHAKE hash function. The location of the EOM padding within the padded message varies depending on the message length, which is usually unknown at compile time. The SHA-3 standard also requires that the last byte of each padded message is a fixed value EOB padding byte.

[0185] like Fig.23A As shown, if the last message block 2300 of the SHA3 / SHAKE message includes more than two bytes that do not contain message data, the EOM padding byte 2302 is inserted into the zeroed byte of the relevant wide vector register 317, immediately following the last message byte 2306, and the EOB padding byte 2304 is inserted into the zeroed byte of the wide vector register 317 as the last byte of the padding message block.

[0186] Fig. 23B A similar second case is shown, where the last message block 2300' of the SHA3 / SHAKE message includes exactly two zeroed bytes that do not contain message data. In this case, the last two zeroed bytes of the last message block 2300' are replaced by EOM padding bytes 2302 and subsequent EOB padding bytes 2304.

[0187] Fig.23C A third case is described in which the last message block 2300" of the SHA3 / SHAKE message includes only a single zeroed message byte following the last message byte 2306. In this case, execution of the padding instruction described below causes the EOM and EOB padding values ​​to be OR'ed together and inserted as the EOM / EOB padding byte 2308 into the last byte of the padding message block 2300".

[0188] Fig.23DThe final case is illustrated, where the last message byte 2306 of the SHA3 / SHAKE message is the last byte of the message block 2310. Because the message block 2310 does not include capacity for the required EOM and EOB padding in this case, an additional zeroed message block 2312 is appended to the message (e.g., by the execution of a load-length instruction). The EOM padding byte 2302 is inserted as the first byte into the zeroed message block 2312, and the EOB padding byte 2304 is inserted as the last byte into the zeroed message block 2312. Note that in FIG. 23A to FIG. 23D In each of the four cases depicted in , both EOM padding and EOB padding can be advantageously applied by a single padding instruction because both EOM padding and EOB padding always fall within the same message block. It should also be understood that although Figure 23A-23D The padding is described as being applied to messages comprising an integral number of message bytes, but padding may be similarly applied to bit messages that do not comprise an integral number of bytes.

[0189] In one embodiment, Figure 23A-23D The padding of SHA3 / SHAKE messages of arbitrary length as shown can be implemented using three instructions. These instructions include: a load-length instruction, which stages the last message block of the padding message into a specified register 301 in the architectural register file 300, (2) a transfer instruction, which transfers the message block from register 301 in the architectural register file 300 to the specified register 301 in the architectural register file 300. Fig.22A One or more wide vector registers 317 in the wide vector register file 316 shown, and (3) padding instructions that insert EOM and EOB padding into the appropriate byte positions (multiple) in the last message block of the padded SHA3 / SHAKE message held in the wide vector register(s) 317. Of course, in alternative implementations, two different instructions may be utilized to insert the EOM padding and EOB padding into the last message block. However, for single block messages such as those typically used in post-quantum cryptography schemes, the addition of additional padding instructions increases latency and undesirably degrades hash performance.

[0190] Figure 24A-Figure 24D Various padding scenarios for SHA2 messages of various lengths are described. According to the SHA-2 standard, each message must include an EOM padding byte with a value of x80 in the byte immediately following the last message byte. The position of the EOM padding byte within the padded message therefore varies depending on the message length. The SHA-2 standard also requires that the last two words (i.e., two 32-bit or two 64-bit words (see Table II) depending on the SHA2 hash function in question) contain EOB padding that specifies the length of the unpadded message in bits.

[0191] exist Fig.24AIn the first case shown, the last message block 2400 of the SHA2 message includes more than two words plus one byte that do not contain message data. In this case, the last message block 2400 is filled by inserting an EOM fill byte 2302 into the zero byte of the associated wide vector register 317 immediately after the last message byte 2406, and by inserting two EOB fill words 2404 as the last two words of the last message block 2400.

[0192] Fig. 24B A similar second case is shown, where the last message block 2400' of the SHA2 message includes exactly two words plus one byte, containing no message data. In this case, the last message block 2400' is filled by inserting the EOM padding byte 2402 into the zeroed byte of the associated wide vector register 317 immediately after the last message byte 2406, and inserting two EOB padding words 2404 as the last two words of the last message block 2400.

[0193] Fig.24C A third case is described in which the last message block 2400" of the unfilled SHA2 message includes too few bytes containing no message data to accommodate an EOM fill byte 2402 and two EOB fill words 2404. In this case, the SHA2 message is filled by inserting the EOM fill byte 2402 into the zeroed bytes immediately following the last message byte 2406 of the associated wide vector register 317. Because the EOB fill word 2404 does not fit in the message block 2400", an additional zeroed message block 2408 is appended to the message (e.g., by executing a load-length instruction). The EOB fill word 2404 is then inserted as the last two words of the message block 2408.

[0194] Fig.24D A fourth case is shown, in which the last message byte 2406 of the SHA2 message forms the last byte of a complete message block 2410. Because the message block 2410 does not include capacity for EOM or EOB padding, an additional zeroed message block 2412 is appended to the SHA2 message. The additional message block 2412 includes the EOM padding byte 2302 as the first byte of the message block 2412, followed by a number of zeroed bytes, and finally two EOB padding words 2404 at the end of the message block 2412.

[0195] In one embodiment, padding of SHA2 messages of arbitrary length may be accomplished using as few as four instructions. These instructions include: a load-length instruction that places the last message block of the SHA2 message in a specified register 301 in the architectural register file 300 and zeroes any register bytes that do not contain message bytes, (2) an insert word instruction that places two EOB padding words 2404 in the appropriate bytes of register 301 in the architectural register file 300 to mark the end of the padded message, (3) a transfer instruction that transfers the contents of register 301 buffering the message block from the architectural register file 300 to a wide vector register 317 in the wide vector register file 316, and (4) a padding instruction that inserts EOM padding bytes 2402 at the appropriate locations in wide vector register 317. In this embodiment, execution of the padding instruction inserts EOM padding bytes 2402 instead of EOB padding words 2404 because (1) the EOM padding bytes 2402 and the EOB padding words 2404 may be located in different message blocks, and (2) the EOB padding words 2404 may be efficiently located in the appropriate registers 301 within the architectural register file 300 using existing insert word instructions. Of course, in alternative embodiments, both the EOM padding bytes 2402 and the EOB padding words 2404 may be applied to the SHA2 message blocks in registers 301 of the architectural register file 300.

[0196] Reference now Fig.25 , shows an exemplary padding instruction 2500 according to one embodiment. In at least one embodiment, the exemplary padding instruction 2500 may be executed by the accelerator unit 314 within the data transfer circuit 406 to perform padding on SHA3 / SHAKE and SHA2 message blocks.

[0197] In the example shown, the fill instruction 2500 includes an opcode field 2502 that specifies an architecture-specific opcode for the message fill instruction. The fill instruction also includes two register fields 2504, 2506, for specifying the storage locations of the source operand and the target operand of the fill operation. For example, the register 1 field 2504 can identify the target wide vector register 317 of the message block to be filled in the buffer within the wide vector register file 316, and the register 2 field 2506 can specify the register 301 in the register file 300 of the architecture that stores the remaining message length in bytes.

[0198] The fill instruction 2500 also includes a mode field 2508, which provides a message for filling the message. In an exemplary embodiment, the mode field 2508 includes at least three subfields, including a hash identifier (HID) subfield 2510, a block length (BL) subfield 2512, and an extension (E) subfield 2514. The HID subfield 2510 indicates the type of hash function applied to the message block. For example, in one implementation, the HID subfield 2510 may include two bits that specify one of the following hash types: SHA3, SHAKE, SHA2 (64-bit word), and SHA2 (32-bit word). The BL subfield 2512 indicates (possibly when interpreted together with the HID subfield 2510) the byte length of the message block. The E subfield 2514 indicates whether the wide vector register 317 specified by the register 1 field 2504 holds the leading segment S0 or the trailing segment S1 of the message block. For example, in an embodiment where the wide vector register 317 is 1024 bits wide, the E subfield 2514 may have a value of b0 if the wide vector register 317 specified by the register 1 field 2504 does not hold a trailing segment of a message block, and may have a value of b1 if the specified wide vector register 317 holds a trailing segment of a message block. Of course, in other embodiments where the wide vector register 317 has a different width (e.g., 512 bits), the E subfield 2514 may include additional bits to specify additional register segments.

[0199] Reference now Fig.26 , shows an exemplary fill circuit 2600 according to one embodiment. The fill circuit 2600, which can be implemented as part of the data transfer circuit 406 of the accelerator unit 314, fills the message segment S1 held in the target wide vector register in response to the execution of the fill instruction 2500, such as Fig.25 The example shown assumes that the wide vector register file 316 has 1024-bit wide vector registers 317 .

[0200] In this exemplary embodiment, the fill circuit 2600 includes a select EOM circuit 2602 that selects the value of the EOM fill byte 2302 or the EOM fill byte 2402 (i.e., eom_byte) based on the hash function specified by the HID subfield 2510 of the fill instruction 2500. The fill circuit 2600 also includes a select EOB circuit 2604 that similarly selects the value of the EOB fill byte (i.e., eob_byte) to be inserted by the fill instruction 2500 based on the HID subfield 2510. In the described embodiment, for the SHA3 / SHAKE hash function, the select EOB circuit 2604 selects a fixed eob_byte value specified by the SHA-3 standard, which is contained in the register indicated by the register 2 field 2506. For the SHA2 hash function, the select EOB circuit 2604 selects a zero eob_byte because the EOB fill word 2404 is inserted by a separate instruction in this embodiment. The fill circuit 2600 also includes a select BL size circuit 2606 that selects and outputs an 8-bit block length value based on the HID field 2510 and the BL field 2512 of the fill instruction 2500 .

[0201] The 8-bit block length value output by the select BL size circuit 2606 is received by the EOB enable circuit 2608, which includes a comparator 2610, a decoder 2612, and a bitwise AND circuit 2614. The high-order bits of the 8-bit block length value indicate whether the length of the message block exceeds the width of the 1024-bit wide vector register 317 (e.g., this would be the case for SHA3-224, SHAKE-128, and SHAKE 256). The low-order 7 bits of the block length form the block length size (bl_size), which indicates the number of bytes comprising the segment of the message block buffered in the target wide vector register 317 identified by the register 1 field 2504. The decoder 2612 decodes the 7-bit bl_size value to obtain a 128-bit representation of the location of the end of the message block within the target wide vector register 317. Comparator 2610 compares the high-order bits of the 8-bit block length with the E subfield 2514 of the fill instruction 2500 to form a 1-bit indication of whether EOB padding is to be added to the segment of the message block buffered in the target wide vector register (i.e., whether the target wide vector register 317 buffers the trailing segment S1 of the message block). Then, bitwise AND circuit 2614 logically combines the 1-bit indication to generate a 128-bit EOB enable signal (eob_en(0:127)), which identifies the byte (if any) of the message segment buffered in the target wide vector register 317 at which the EOB padding is to be inserted.

[0202] Still reference Fig.26, the padding circuit 2600 also includes an EOM enabling circuit 2620, which includes a selection circuit 2620, a comparator 2610, a decoder 2612, and a bitwise AND circuit 2614. In the described example, the selection circuit 2620 is implemented with a dual-input multiplexer having a first input coupled to receive an 8-bit message length indication and a second input coupled to receive an extended message length suitable for a SHA-2 hash function using a 32-bit word. By inserting b0 between the 5th and 6th bits of the original length, the extended message length value at the second input doubles the original length of the message according to the equation EX_LEN=4*(LEN / 4)+LEN. This technique saves the bit position of the initial bits 6:7 indicating the byte position (if any) within the 32 high-order bits of the extended message block of the last message byte. If the HID subfield 2510 indicates that the hash function is a SHA3 / SHAKE hash function or a SHA2 hash function using 64-bit words, the selection circuit 2620 selects the first of its two 8-bit inputs, and alternatively, if the HID subfield 2510 indicates that the hash function is a SHA2 hash function using 32-bit words, it selects the second of its two inputs.

[0203] The 8-bit length value output by the select circuit 2620 includes a high-order bit indicating whether the block length exceeds the width of the 1024-bit wide vector register file 316 and seven lower-order bits indicating the number of bytes included in the segment of the message block buffered in the target wide vector register 317 identified by the register 1 field 2504. The decoder 2612 decodes the seven low-order bits to obtain a 128-bit representation of the byte position at which, if any, the end of the message bytes are to be inserted into the target wide vector register 317. The comparator 2622 compares the high-order bits of the length value output by the select circuit 2620 with the E subfield 2514 of the fill instruction 2500 to form a 1-bit indication of whether EOM padding is to be added to the segment of the message block buffered in the target wide vector register 317. The bit-by-bit AND circuit 2626 then logically combines the 1-bit indication to generate a 128-bit EOM enable signal (eom_en(0:127)) that identifies the byte of the message segment buffered in the target wide vector register 317 (if any) at which the EOM padding is to be inserted.

[0204] The EOB enable signal EOB_en (0:127), the EOM enable signal EOM_en (0:127), the EOM_byte, the EOB_byte, and the message segment from the target wide vector register 317 are all passed to the conditional OR circuit 2630, which conditionally inserts the EOM and / or EOB padding into the message segment to obtain the padding message segment Sp. The padding message segment Sp is then stored back to the target wide vector register 317 specified in the register 1 field 2504.

[0205] Reference now Fig. 27 ,illustrate Fig.26 2700 . An exemplary embodiment of a conditional OR circuit 2630 is shown in FIG. 2600 , in which each of the 128-byte message segments has a respective associated OR gate 2700 having three 8-bit inputs. A first input of the OR gate 2700 is coupled to receive the corresponding byte of the message segment S, a second input of the OR gate 2700 is coupled to the output of a two-input AND gate 2702, which qualifies eom_byte with eom_en() of a given byte of the message segment S, and a third input of the OR gate 2700 is coupled to the output of a two-input AND gate 2704, which qualifies eob_byte with eob_en() of a given byte of the message segment S. The OR gate 2700 performs a logical OR operation on these three inputs and writes the resulting byte of the padded message segment Sp to the destination wide vector register 317 in the wide vector register file 316. Therefore, if neither eom_en() nor eob_en() is asserted for a given byte of the message segment S, the associated OR gate 2700 simply writes the byte of the input message segment S into the corresponding byte of the padded message segment Sp. However, if one or both of eom_en() or eob_en() is asserted for a given byte of message segment S, the associated OR gate 2700 writes eom_byte, eob_byte, or a logical combination thereof, into the corresponding byte of the padding message segment Sp, as indicated by the enable signals eom_en() and eob_en().

[0206] Reference now Fig.28 , which shows a high-level logic flow diagram of an exemplary process for filling a message block according to one embodiment. The process shown can be performed by the accelerator unit 314 in response to receiving the fill instruction 2500. For ease of understanding, the following reference Figure 26-Figure 27 The process is described with reference to the exemplary filling circuit described in FIG.

[0207] Fig.28The process begins at block 2800 and then proceeds to block 2802, which shows that the accelerator unit 314 receives the fill instruction 2500 for execution. In response to receiving the fill instruction 2500, the accelerator unit 314 first accesses the source operands specified by the register fields 2504, 2506 of the fill instruction 2500 (block 2804). In particular, the accelerator unit 314 reads the message segment S specified by the register 1 field 2504 from the target wide vector register 317 in the wide vector register file 316, reads the unfilled message length specified by the register 2 field 2506 from the register 301 in the architectural register file 300, and transfers these operands to Fig.26 The fill circuit 2600 of the data transfer circuit 406, as described above, can be implemented within the data transfer circuit 406. At block 2806, the fill circuit 2600 utilizes the mode field 2508 of the fill instruction 2500 to select parameters for the fill operation. Specifically, the select EOM circuit 2602 selects the value of the EOM fill byte (eom_byte) 2302 or 2402 based on the hash function specified by the mode field 2508, the select EOB circuit 2604 selects the value of the EOB fill byte (eob_byte) to be inserted by the fill instruction 2500 (i.e., a fixed value for SHA3 / SHAKE and a zero byte for SHA2, because the EOB fill word 2404 is applied by a separate instruction for SHA2), and the select BL size circuit 2606 selects the block length based on the HID subfield 2510 and the BL subfield 2512. The eob_byte selected by the select EOM circuit 2602 and the eob_byte selected by the select EOB circuit 2604 form the input to the conditional OR circuit 2630.

[0208] At block 2808, selection circuit 2620 determines whether the hash function applied to the message is one of the SHA2-224 or SHA2-256 hash functions that employ 32-bit words based on the HID subfield of mode field 2508. If not, selection circuit 2620 selects and outputs the message length read from register 301 identified by register 2 field 2506 as the length of the message, and Fig.28 The process proceeds to block 2812 described below. However, if the selection circuit 2620 determines at block 2808 that the HID subfield 2510 of the fill instruction 2500 indicates a SHA2 hash function using a 32-bit word, the selection circuit 2620 selects and outputs a double length for the SHA2 message to resolve the above reference Fig.15 The message extension, in one implementation, the extended SHA2 message length can be conveniently calculated as: 4*(LEN / 4)+LEN. Then, the process proceeds from block 2810 to block 2812.

[0209] Block 2812 shows that the EOM enabling circuit 2620 determines whether to place the EOM padding in the current message segment. If not, the EOM enabling vector EOM_en (0:127) generated by the EOM enabling circuit 2620 is all zero, and no EOM padding is inserted into the message segment S. However, if the EOM enabling circuit 2620 determines in block 2812 that the EOM padding is to be inserted into the message segment S, the EOM enabling circuit 2620 generates the EOM enabling vector EOM_en (0:127), which identifies the byte in the message segment S into which the EOM padding byte is to be inserted, and the EOM padding byte is inserted into the specified byte of the padding message segment Sp by the conditional OR circuit 2630 (block 2814). The process proceeds from block 2814 to block 2816.

[0210] At block 2816, the BL size circuit 2606 and the EOB enable circuit 2608 determine whether the hash function specified by the mode field 2508 of the hash instruction 2500 is a SHA3 or SHAKE hash function, and the EOB padding bytes are to be inserted into the message segment S. If not, the EOB enable vector EOB_en (0:127) generated by the EOB enable circuit 2608 is all zero, and no EOB padding is inserted into the message segment S. However, if the BL size circuit 2606 and the EOB enable circuit 2620 determine at block 2816 that the hash function specified by the mode field 2508 is a SHA3 or SHAKE hash function, and the EOB padding is to be inserted into the message segment S, the EOB enable circuit 2608 generates an EOB enable vector EOB_en (0:127) identifying the bytes of the message segment S, the EOB padding bytes are to be inserted at the bytes, and the EOB padding bytes are inserted into the specified bytes of the padded message segment Sp by the conditional OR circuit 2630 (block 2818). The process then proceeds to block 2820.

[0211] Block 2820 shows that the data transfer circuit 406 writes the result fill message segment Sp to the target wide vector register 317 specified by the register 1 field 2504. Thereafter, Fig.28 The process ends at block 2822.

[0212] Reference now Fig.29, a block diagram of an exemplary design flow 2900 used, for example, in semiconductor IC logic design, simulation, testing, layout, and manufacturing is shown. Design flow 2900 includes processes, machines, and / or mechanisms for processing design structures or devices to generate logically or otherwise functionally equivalent representations of the design structures and / or devices described above and shown herein. The design structures processed and / or generated by design flow 2900 may be encoded on a machine-readable transmission or storage medium to include data and / or instructions that, when executed or otherwise processed on a data processing system, generate logically, structurally, mechanically, or otherwise functionally equivalent representations of hardware components, circuits, devices, or systems. Machines include, but are not limited to, any machine used in an IC design process, such as to design, manufacture, or simulate circuits, components, devices, or systems. For example, the machine may include: a photolithography machine, a machine and / or apparatus for generating masks (e.g., an electron beam writer), a computer or device for simulating a design structure, any apparatus for a manufacturing or testing process, or any machine for programming a functionally equivalent representation of a design structure into any medium (e.g., a machine for programming a programmable gate array).

[0213] The design flow 2900 may vary depending on the type of representation being designed. For example, the design flow 2900 for building an application specific IC (ASIC) may be different from the design flow 2900 for designing a standard component or different from the design flow 2900 for instantiating a design into a programmable array, such as a programmable gate array (PGA) or a field programmable gate array (FPGA) provided by Altera Corporation or Xilinx Corporation.

[0214] Fig.29A plurality of such design structures are shown, including an input design structure 1020 that is preferably processed by the design process 2910. The design structure 2920 may be a logic simulation design structure generated and processed by the design process 2910 to generate a logically equivalent functional representation of a hardware device. The design structure 2920 may also or alternatively include data and / or program instructions that, when processed by the design process 2910, generate a functional representation of the physical structure of the hardware device. Whether representing functional and / or structural design features, the design structure 2920 may be generated using electronic computer-aided design (ECAD) such as implemented by a core developer / designer. When encoded on a machine-readable data transmission, gate array, or storage medium, the design structure 2920 may be accessed and processed by one or more hardware and / or software modules within the design process 2910 to simulate or otherwise functionally represent an electronic component, circuit, electronic or logic module, device, apparatus, or system such as those shown herein. Thus, design structure 2920 may include files or other data structures, including human and / or machine readable source code, compiled structures, and computer executable code structures, which, when processed by a design or simulation data processing system, functionally simulate or otherwise represent a circuit or other level of hardware logic design. Such data structures may include hardware description language (HDL) design entities or other data structures that conform to and / or are compatible with low-level HDL design languages ​​such as Verilog and VHDL and / or high-level design languages ​​such as C or C++.

[0215] The design process 2910 preferably employs and combines hardware and / or software modules for synthesizing, converting or otherwise processing design / simulation functions equivalent to the components, circuits, devices or logic structures shown here to generate a netlist 2980 that can contain a design structure such as the design structure 2920. The netlist 2980 may include, for example, a compiled or otherwise processed data structure that represents a list of wires, discrete components, logic gates, control circuits, I / O devices, models, etc. that describe connections to other elements and circuits in the integrated circuit design. The netlist 2980 can be synthesized using an iterative process, in which the netlist 2980 is resynthesized one or more times according to the design specifications and parameters of the device. As with other design structure types described herein, the netlist 2980 can be recorded on a machine-readable storage medium or programmed into a programmable gate array. The medium can be a non-volatile storage medium, such as a disk or optical drive, a programmable gate array, a compact flash or other flash memory. Additionally or alternatively, the medium can be a system or cache memory, or a buffer space.

[0216] The design process 2910 may include hardware and software modules for processing various input data structure types including the netlist 2980. Such data structure types may reside, for example, within the library unit 2930 and include a set of commonly used units, circuits, and devices, including models, layouts, and symbolic representations, for a given manufacturing technology (e.g., different technology nodes, 32nm, 45nm, 290nm, etc.). The data structure types may also include design specifications 2940, characteristic data 2950, ​​verification data 2960, design rules 2990, and test data files 2985, which may include input test patterns, output test results, and other test information. The design process 2910 may also include, for example, standard mechanical design processes such as stress analysis, thermal analysis, mechanical event simulation, process simulation for operations such as casting, molding, and compression molding, etc. The design process 2910 may also include modules for performing standard circuit design processes such as timing analysis, verification, design rule checking, layout and routing operations, etc.

[0217] Design process 2910 employs and combines logical and physical design tools, such as HDL compilers and simulation model building tools, to process design structure 2920 along with some or all of the supporting data structures described, along with any additional mechanical design or data (if applicable), to generate a second design structure 2990. Design structure 2990 resides on a storage medium or programmable gate array in a data format for data exchange of mechanical devices and structures (e.g., information stored in IGES, DXF, Parastoll XT, JT, DRG, or any other suitable format for storing or presenting such mechanical design structures). Similar to design structure 2920, design structure 2990 preferably includes one or more files, data structures, or other computer-encoded data or instructions that reside on a transmission or data storage medium and, when processed by an ECAD system, generate a logically or other functionally equivalent form of one or more embodiments of the present invention shown herein. In one embodiment, design structure 2990 may include a compiled executable HDL simulation model that functionally simulates the devices shown herein.

[0218] Design structure 2990 may also be in a data format and / or symbol data format for exchanging layout data of integrated circuits (e.g., information stored in GDSII (GDS2), GL1, OASIS, a drawing file, or any other suitable format for storing such a design data structure). Design structure 2990 may include information such as symbol data, drawing files, test data files, design content files, manufacturing data, layout parameters, wiring, metal layers, vias, shapes, data for routing through a production line, and any other data required by a manufacturer or other designer / developer to produce the devices or structures described above and shown herein. Design structure 2990 may then proceed to stage 2995, where, for example, design structure 2990 is: taped out, delivered to manufacturing, delivered to a mask shop, sent to another design shop, sent back to a customer, etc.

[0219] As described, in at least one embodiment, the processor includes a register file and an execution unit. The execution unit includes a hash circuit, which includes at least a state register, a state update circuit coupled to the state register, and a control circuit. Based on the hash instruction, the hash circuit receives the current state of the hashed message from the register file and buffers the state in the state register. The state update circuit performs a state update function on the content of the state register, wherein executing the state update function includes performing multiple iterative processing rounds on the content of the state register, and returning the result of each iterative processing round in the multiple iterative processing rounds to the state register. After completing all multiple iterative processing rounds, the execution unit stores the content of the state register in the register file as the updated state of the message.

[0220] In one embodiment, a method of data processing includes acquiring, by an instruction acquisition unit of a processor, an instruction to be executed by the processor, wherein the instruction includes a message fill instruction, which includes an operand of one of a plurality of registers indicating a message block segment of a buffer to be filled with a message block, and a mode field indicating which of a plurality of different hash functions is to be applied to the message block. Based on receiving the message fill instruction, an execution unit of the processor executes the message fill instruction. Executing the message fill instruction includes receiving a message block segment from a register file from one of a plurality of registers indicated by an operand field of the message fill instruction, wherein the message block spans a plurality of registers in the register file. Based on which of a plurality of different hash functions is indicated by a mode field of the message fill instruction, a byte position in the message block segment is selected, at least one fill byte is inserted at the position, and at least one fill byte is inserted at a byte position within the message block segment. The message block segment filled with at least one fill byte is written back to the register file.

[0221] In one embodiment, the message block comprises a plurality of message block segments, and the execution unit is configured to detect which message block segment of the plurality of message block segments the message block segment is based on an indication in the mode field.

[0222] In one embodiment, the multiple different hash functions include a first hash function and a second hash function, and the execution unit is configured to insert end-of-message (EOM) padding and end-of-block (EOB) padding in the message block segment based on the mode field indicating the first hash function, and is configured to insert EOM padding without inserting EOB padding in the message block segment based on the mode field indicating the second hash function.

[0223] In one embodiment, the operand field of the message fill instruction indicates one of a plurality of registers for a length parameter of a buffered message segment, and the execution unit is configured to interpret the length parameter differently based on which of a plurality of hash functions is indicated by the mode field.

[0224] In one embodiment, the at least one padding byte includes an end-of-message (EOM) padding byte, selecting the byte position includes generating an EOM enable vector having a length corresponding to the message block segment, and inserting the at least one padding byte includes inserting the EOM padding byte at the byte position in the message block segment based on the EOM enable vector.

[0225] In one embodiment, the fill circuitry includes selection circuitry configured to select a value for the EOM fill byte based on which of a plurality of different hash functions is indicated by a mode field of the fill instruction.

[0226] In one embodiment, the register file is a first register file comprising a first plurality of registers, the processor comprises a second register file comprising a second plurality of registers, each register having a length less than a length of the first plurality of registers, and the execution unit is further configured to combine a plurality of data blocks of the message block segment in a plurality of registers among the second plurality of registers, and transfer all of the plurality of data blocks to a register of the first plurality of registers to form the message block segment.

[0227] In one embodiment, the processor is further configured to insert end of block (EOB) padding in a register among the second plurality of registers before transferring the plurality of data blocks to a register among the first plurality of registers.

[0228] In one embodiment, the at least one pad byte includes an end-of-block (EOB) pad byte, selecting the byte position includes generating an EOB enable vector having a length corresponding to the message block segment, and inserting the at least one pad byte includes inserting the EOB pad byte at the byte position in the message block segment based on the EOB enable vector.

[0229] In one embodiment, inserting at least one stuff byte includes logically combining an EOB stuff byte with an end of message (EOM) stuff byte.

[0230] In one embodiment, the execution unit comprises a hash circuit configured, based on a hash instruction, to apply a hash function from among the SHA hash function family to the padded message block comprising the message block segment as padded.

[0231] In one embodiment, the message block segment is a portion of a message comprising message blocks having the same length of r bits, such as the padded message block comprises r bits and each register of the plurality of registers has a length less than r bits.

[0232] Although various embodiments have been specifically shown and described, those skilled in the art will appreciate that various changes in form and detail may be made thereto without departing from the spirit and scope of the appended claims, and that such alternative implementations all fall within the scope of the appended claims. For example, although the present invention has been described with specific reference to the SHA family of standards, those skilled in the art will appreciate that the disclosed invention may also be applied to other hash algorithms (e.g., general Keccak functions, etc.). Furthermore, although illustrative numbers of bits and bytes are discussed herein for ease of understanding, it should be understood that the specific numbers of bits and bytes employed in a hash algorithm can and do change over time, and that the principles of the disclosed invention apply to cryptographic algorithms regardless of the specific numbers of bits and bytes in a given implementation.

[0233] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention.In this regard, each block in the flow chart or block diagram can represent a module, segment or part of an instruction, which includes one or more executable instructions for realizing a specified logical function.In some alternative implementations, the functions mentioned in the block may not occur in the order mentioned in the figure.For example, the two blocks shown in succession can actually be performed substantially simultaneously, or these blocks can sometimes be performed in reverse order, depending on the functions involved.It will also be noted that each block of the block diagram and / or flow chart illustration and the combination of the blocks in the block diagram and / or flow chart illustration can be realized by a dedicated hardware-based system that performs a specified function or action or performs a combination of special hardware and computer instructions.

[0234] Furthermore, although aspects have been described with respect to a computer system executing program code directing the functions of the present invention, it should be understood that the present invention may alternatively be implemented as a program product including a computer-readable storage device storing program code that can be processed by a data processing system. The computer-readable storage device may include volatile or non-volatile memory, an optical or magnetic disk, etc. However, as employed herein, "storage device" is specifically defined to include only statutory manufacturing terms and exclude signal media per se, transient propagating signals per se, and energy per se.

[0235] The program product may include data and / or instructions that, when executed or otherwise processed on a data processing system, generate a logically, structurally, or otherwise functionally equivalent representation (including a simulation model) of the hardware components, circuits, devices, or systems disclosed herein. Such data and / or instructions may include hardware description language (HDL) design entities or other data structures that conform to and / or are compatible with low-level HDL design languages ​​such as Verilog and VHDL and / or high-level design languages ​​such as C or C++. In addition, the data and / or instructions may also be in a data format and / or symbolic data format for exchanging layout data of integrated circuits (e.g., information stored in GDSII (GDS2), GL1, OASIS, mapping files, or any other suitable format for storing such design data structures).

Claims

1. A processor, comprising: an instruction acquisition unit, wherein the instruction acquisition unit acquires instructions to be executed; a register file including a plurality of registers for storing source operands and destination operands; as well as an execution unit for executing a message stuffing instruction, wherein the message stuffing instruction comprises an operand field indicating one of the plurality of registers that buffers a message block segment of a message block to be stuffed and a mode field indicating which of a plurality of different hash functions is to be applied to the message block, wherein the execution unit comprises a stuffing circuit, the stuffing circuit being configured based on the message stuffing instruction to perform: receiving a message block segment from one of the plurality of registers indicated by the operand field of the message fill instruction, wherein the message block spans a plurality of registers in the register file; determining whether at least one pad byte is to be inserted into the message block segment based on which of the plurality of different hash functions is indicated by the mode field of the message padding instruction; based on determining that the at least one pad byte is to be inserted within the message block segment, selecting a byte position in the message block segment based on which of the plurality of different hash functions is indicated by the mode field, inserting the at least one pad byte at the byte position, and inserting the at least one pad byte at the selected byte position within the message block segment; refraining from inserting the at least one stuffing byte into the message block segment based on determining that the at least one stuffing byte will not be inserted into the message block segment; as well as The message block segment as filled by the at least one pad byte is written back to the register file.

2. The processor of claim 1, wherein the plurality of different hash functions include a SHA3 hash function, a SHAKE hash function, and a SHA2 hash function.

3. A processor according to any one of claims 1 or 2, wherein: The message block includes a plurality of message block segments; and The execution unit is configured to detect which message block segment of the plurality of message block segments the message block segment is based on an indication in the mode field.

4. A processor according to any one of claims 1 to 3, wherein: The plurality of different hash functions include a first hash function and a second hash function; and The execution unit is configured to insert end-of-message (EOM) padding and end-of-block (EOB) padding into the message block segment based on the mode field indicating the first hash function, and is configured to insert EOM padding instead of EOB padding into the message block segment based on the mode field indicating the second hash function.

5. A processor according to any one of claims 1 to 4, wherein: The plurality of hash functions include a first hash function and a second hash function; The selecting comprises selecting the byte position based on a length parameter indicated by the operand field of the message fill instruction; as well as The execution unit is configured to insert the at least one padding byte at a first byte position based on the length parameter when the mode field indicates the first hash function, and is configured to insert the at least one padding byte at a different second byte position based on the length parameter when the mode field indicates the second hash function.

6. A processor according to any one of claims 1 to 5, wherein: The fill circuitry includes a selection circuit configured to select a value for the at least one fill byte based on which of the plurality of different hash functions is indicated by the mode field of the fill instruction.

7. A processor according to any one of claims 1 to 6, wherein: The register file is a first register file; The plurality of registers is a first plurality of registers; the processor comprising a second register file comprising a second plurality of registers, each register having a length less than a length of the first plurality of registers; The execution unit is further configured to combine a plurality of data blocks of the message block segment in a plurality of registers among the second plurality of registers and transfer all of the data blocks to one of the first plurality of registers to form the message block segment.

8. The processor of claim 7, wherein the processor is further configured to insert end-of-block EOB padding into one of the plurality of registers among the second plurality of registers before transferring the plurality of data blocks to the one of the first plurality of registers.

9. A processor according to any one of claims 1 to 8, wherein: Selecting the byte position includes generating an enable vector having a length corresponding to the message block segment; and Inserting the at least one stuffing byte comprises inserting the at least one stuffing byte at the byte position in the message block segment based on the enabling vector.

10. A processor according to any one of claims 1 to 9, wherein: Inserting the at least one stuffing byte comprises logically combining an end-of-block (EOB) stuffing byte with an end-of-message (EOM) stuffing byte and inserting the combined stuffing byte.

11. A processor according to any one of claims 1 to 10, wherein: The execution unit comprises a hash circuit configured, based on a hash instruction, to apply a hash function from among the SHA hash function family to a padding message block comprising the message block segment as padded.

12. A processor according to any one of claims 1 to 11, wherein: The message block segment is a portion of a message, the portion comprising a plurality of message blocks having the same length of r bits; said message block as padded comprises r bits; and Each register of the plurality of registers has a length less than r bits.

13. A method of data processing in a processor including a register file, the method comprising: fetching, by an instruction fetch unit of the processor, an instruction to be executed by the processor, wherein the instruction comprises a message fill instruction, the message fill instruction comprising an operand field indicating one of the plurality of registers that buffers a message block segment in a message block to be filled and a mode field indicating which hash function of a plurality of different hash functions is to be applied to the message block; as well as Based on receiving the message filling instruction, the execution unit of the processor executes the message filling instruction, wherein executing the message filling instruction includes: receiving, from the register file, a message block segment from one of the plurality of registers indicated by the operand field of the message fill instruction, wherein the message block spans a plurality of registers in the register file; determining whether at least one pad byte is to be inserted into the message block segment based on which of the plurality of different hash functions is indicated by the mode field of the message padding instruction; based on determining that the at least one pad byte is to be inserted into the message block segment, selecting a byte position in the message block segment based on which of the plurality of different hash functions is indicated by the mode field, inserting the at least one pad byte at the byte position, and inserting the at least one pad byte at the selected byte position within the message block segment; Based on determining that the at least one stuffing byte is not to be inserted into the message block segment, avoiding inserting the at least one stuffing byte into the message block segment; and writing the message block segment as filled by the at least one stuffing byte back to the register file.

14. The method according to claim 13, wherein: The message block includes a plurality of message block segments; and The method further comprises detecting which message block segment of the plurality of message block segments the message block segment is based on an indication in the mode field.

15. The method according to any one of claims 13 or 14, wherein: The plurality of different hash functions include a first hash function and a second hash function; and The execution includes inserting end-of-message EOM padding and end-of-block EOB padding into the message block segment based on the mode field indicating the first hash function, and is configured to insert EOM padding instead of EOB padding into the message block segment based on the mode field indicating the second hash function.

16. The method according to any one of claims 13 to 15, wherein: The plurality of hash functions include a first hash function and a second hash function; The selecting comprises selecting the byte position based on a length parameter indicated by the operand field of the message fill instruction; and The insertion operation includes inserting the at least one padding byte at a first byte position based on the length parameter when the mode field indicates the first hash function, and inserting the at least one padding byte at a different second byte position based on the length parameter when the mode field indicates the second hash function.

17. The method according to any one of claims 13 to 16, further comprising: A value of the at least one pad byte is selected by the execution unit based on a hash function indicated by the mode field of the pad instruction.

18. The method according to any one of claims 13 to 17, wherein: The register file of the processor is a first register file; The plurality of registers is a first plurality of registers; the processor comprising a second register file comprising a second plurality of registers, each register having a length less than a length of the first plurality of registers; The method further includes assembling a plurality of data blocks of the message block segment in a plurality of registers among the second plurality of registers, and transferring all of the data blocks among the plurality of data blocks to one of the first plurality of registers to form the message block segment.

19. The method of claim 18, further comprising inserting end-of-block (EOB) padding into one of the plurality of registers among the second plurality of registers prior to transferring the plurality of data blocks to the one of the first plurality of registers.

20. The method according to any one of claims 13 to 19, further comprising: Based on the hash instruction, a hash function from among the SHA hash function family is applied by the hash circuit of the processor to the padding message block including the message block segment as padded.

Images